Data Processing Addendum

Subject matter: the recording and presentation of technical delivery and interaction evidence for links, landing pages and tracking images created in your workspace. Nature and purpose: collecting the signals described in the Privacy Policy, Part B; storing them; classifying and deduplicating them; and making them available to you in the dashboard, the v1 API and the MCP server. Duration: for as long as your account exists, and for each record no longer than the retention below.

Data subjects

The people who open a link, landing page or tracking image you created. IPForge does not know who they are and holds no name, account or contact detail for them — only the technical signals below, which may nonetheless be personal data because an IP address is.

Categories of data

IP address and the approximate location and network derived from it; request headers; device, browser and rendering characteristics; the environment and local-network probe results; a fingerprint hash; classification outcomes; and, if you enable it, coarse engagement on a landing page. The full, itemized list is in the Privacy Policy, Part B — it is the authoritative version of this row.

Special categories

None are requested, and none should be collected. Do not use IPForge in a way that infers health, beliefs, sexuality, union membership or any other special category from where or to whom you send a link.

IPForge processes this data only on your documented instructions — which, in practice, are the settings you choose for each link and the calls you make through the product. It is not used for our own purposes, not sold, not shared for advertising, and not used to train anything.

Two exceptions, both narrow and both named: aggregate counts that identify nobody are used to operate and bill the service, and a record may be examined when investigating a specific abuse report or a security incident under clause 8 of the Terms.

Access to production data is limited to the operator and anyone the operator explicitly authorizes, each under a duty of confidentiality. There is no support team with standing access to customer captures.

TLS on every connection; passwords stored as bcrypt hashes; API tokens stored as hashes and shown once; authentication required for the dashboard and every v1 operation; the client IP taken from the reverse proxy rather than a client-supplied header; the dashboard and the API excluded from search indexing; database access restricted to the application on the same host.

The complete list of everyone outside IPForge who may touch data, and exactly what each receives:

Only the first of these — the host — touches visitor data at all; the other three exist for account sign-in, payment confirmation and optional alerts. Geolocation is deliberately not on this list: it is computed on our own server from licensed MaxMind database files, so no IP address is sent anywhere to be looked up.

This page is the notice mechanism. A new sub-processor appears here before it starts processing, and the date at the top changes with it; if you object, you may close your account and stop processing.

If someone asks you for access to, or deletion of, what you collected about them, you can act yourself: deleting the link, the image or the individual capture in the dashboard deletes the record. If you need something the product cannot do, write to admin@ipforge.xyz and we will help within the time the law gives you.

A request that reaches us instead of you is not answered on your behalf: we pass it to you as the controller, and we tell the person we have done so.

If we become aware of a personal-data breach affecting your workspace, we will tell you without undue delay and in any case within 72 hours of becoming aware, with what we know: what happened, which data and roughly how many records, what we have done, and what we recommend. The notice goes to the email address on your account.

Visitor data is stored on a server in Germany. The three non-hosting sub-processors above are reached only for account sign-in, payment confirmation or alerts; two of them are in the United States, and those transfers are covered by the Standard Contractual Clauses in their own terms. No visitor capture is sent to any of them.

Captures (the visitor records above)

Until the workspace owner deletes the link, the image or their account. Deleting any of them deletes the captures with it; there is no separate archive.

Engagement sessions

30 minutes of session lifetime, then the row expires and is swept.

Raw delivery-test observations

7 days, after which only the summarized evidence remains. A delivery test itself lives at most 7 days.

Account records

For as long as the account exists, and afterwards only what is needed for tax, accounting and abuse records.

You can export your data at any time through the v1 API. Closing your account deletes the links, the images and every capture attached to them; nothing is kept in a shadow archive. Backups roll forward and a deleted record does not survive them by more than the backup window.

On reasonable request, we will provide the information needed to show that this addendum is being kept, including answering a security questionnaire. On-site audits are not offered by a service of this size; an independent audit at your expense is possible if the law obliges you to have one.

If this addendum conflicts with the Terms of Service, this addendum wins for anything about the processing of visitor data. The parties are you, as controller, and PENDING — registered legal name and address as processor, under the law named in the Terms, clause 12.

Version of 2026-09-23.